Notice of U.S. Export Controls for Restricted Products

The sale, export and re-export of Rapid7 LLC ("Rapid7") products, technology, software and/or any other items deemed an export by the U.S. Government are subject to the laws and regulations of the United States. Diversion contrary to U.S. law is strictly prohibited.

Rapid7's products are subject to U.S. export controls. The sale, use, reexport or transfer of Rapid7's products must comply with all applicable export and reexport control laws and regulations, including the Export Administration Regulations (EAR), administered by the U.S. Department of Commerce, and trade and economic sanctions, administered by the U.S. Treasury Department's Office of Foreign Assets Control (OFAC). Specifically, no person or entity may - directly or indirectly - sell, export, reexport, transfer, divert, or otherwise dispose of any product, software, or technology (including products derived from or based on such technology) to any destination, entity, or person prohibited by the laws or regulations of the United States, without obtaining prior authorization from the U.S. government as required by those laws and regulations. In addition, depending on the location and/or distribution of Rapid7's products, they may also be subject to the export control and import laws of other jurisdictions.

Encryption Controls

Many of Rapid7's products are subject to additional export restrictions under U.S. law because they include encryption technology. Rapid7's encryption products are eligible for export to most destinations under section 740.17 of the EAR (License Exception ENC), subject to the prohibited end-use and end-user restrictions discussed below.

Please note: Rapid7's Metasploit products (i.e., Metasploit Pro and Metasploit Community Edition)are restricted items under section 740.17(b)(2) of the EAR and may not be transferred without a license to any "Government End-Users," as defined in Part 772 of the EAR, outside the U.S. and Canada. Therefore, Government End- Users located outside the U.S. and Canada require a U.S. export license in order to obtain the restricted products.

Prohibited End Users

No Rapid7 products can be transferred without a license to any country subject to U.S. embargoes or anti-terrorism controls (currently Crimea, Cuba, Iran, North Korea, Sudan, and Syria). The exportation, re-exportation, sale or supply, directly or indirectly, from the United States, or by a U.S. person wherever located, of any Rapid7 products to any of these countries is strictly prohibited without prior authorization by the U.S. Government. No person or entity may transfer Rapid7 products without a license to anyone on a U.S. Government list of prohibited persons, including but not limited to the U.S. Treasury Department's list of Specially Designated Nationals and Blocked Persons and the U.S. Commerce Department's Denied Persons List, Entity List, or Unverified List. Additionally, as noted above, many of Rapid7's products are restricted items that may not be transferred without a license to Government End-Users outside the U.S. and Canada.

Prohibited/Restricted End Uses

All transactions involving Rapid7 products must comply with U.S. laws and regulations concerning prohibited or restricted end uses. The EAR prohibits and/or strictly regulates all sales, exports or re-exports of software, support and services which will be used in conjunction with certain activities such as the research, development, design, manufacture, construction, operation or maintenance of nuclear, chemical, or biological weapons and certain other nuclear technology.